Verify a Release Candidate¶

When a release candidate (RC) is published for a vote, community members are encouraged to verify it before casting their vote.

Prerequisites¶

curl
gpg
shasum or sha512sum
tar
CMake 3.25+
C++23 compliant compiler (GCC 14+, Clang 16+, MSVC 2022+)

Verification Steps¶

We provide a script that automates the entire verification process:

dev/release/verify_rc.sh ${VERSION} ${RC}

For example, to verify RC0 of version 0.3.0:

dev/release/verify_rc.sh 0.3.0 0

The script performs the following checks:

Downloads the source tarball from ASF's dev distribution
Imports the KEYS file and verifies the GPG signature
Verifies the SHA-512 checksum
Extracts the source and builds with CMake
Runs the full test suite

If everything passes, you will see:

RC looks good!

Manual Verification¶

If you prefer to verify manually:

1. Download the RC¶

VERSION=0.3.0
RC=0
BASE_URL="https://dist.apache.org/repos/dist/dev/iceberg/apache-iceberg-cpp-${VERSION}-rc${RC}"

curl -O "${BASE_URL}/apache-iceberg-cpp-${VERSION}.tar.gz"
curl -O "${BASE_URL}/apache-iceberg-cpp-${VERSION}.tar.gz.asc"
curl -O "${BASE_URL}/apache-iceberg-cpp-${VERSION}.tar.gz.sha512"

2. Verify Signature and Checksum¶

# Import KEYS
curl https://downloads.apache.org/iceberg/KEYS | gpg --import

# Verify GPG signature
gpg --verify apache-iceberg-cpp-${VERSION}.tar.gz.asc apache-iceberg-cpp-${VERSION}.tar.gz

# Verify SHA-512 checksum
shasum -a 512 -c apache-iceberg-cpp-${VERSION}.tar.gz.sha512

3. Build and Test¶

tar xf apache-iceberg-cpp-${VERSION}.tar.gz
cd apache-iceberg-cpp-${VERSION}

cmake -S . -B build -DCMAKE_BUILD_TYPE=Release -DICEBERG_BUILD_STATIC=ON -DICEBERG_BUILD_SHARED=ON
cmake --build build
ctest --test-dir build --output-on-failure